I currently have a naughty user in my environment. We don't want to set any alarms of (even from speaking to the AD admins), and wish to discover the workstation the user is connected to in our AD environment. At this point in time all I know is the username.
How can I discover the workstation name the user is connected to from only knowing the username?
i) I could export the AD security log and look for the users logon event, as the logon event captures the workstation name.
ii) Scan through all the IP's in my network and write a script like the below to get the username currently logged into IP x
for /f %%a in (IP.txt) do WMIC /NODE:%%a computersystem GET name, username